@memoarchitect/ontology 0.13.2 → 0.15.0

package/src/methodology/core/memo_core.sysml

@@ -6,14 +6,16 @@ package memo_methodology_core {
     private import memo_core_common::*;
     private import memo_core_enumerations::*;
     private import memo_core_consistency_rules::*;
+    private import memo_artifacts_standards_traceability::RegulatoryStandard;
+    private import memo_viewpoints_definitions::MemoViewpoint;
+    private import memo_viewpoints_stakeholders_concerns::MemoStakeholder;
 
     part def MethodologyLibrary :> MemoPart {
         attribute version : String;
         attribute domain : String;
-        attribute :>> description : String;
     }
 
-    // A rule's disposition under one methodology or project binding.
+    // A rule's disposition under one methodology or model binding.
     //
     // `targetRule` and `replacementRule` are typed references to the rule's own
     // `constraint def`, narrowed at the usage with `ref :>> targetRule : <Rule>`.
@@ -22,8 +24,21 @@ package memo_methodology_core {
     // would be a MEMO-specific identifier where the language has one. The
     // stable rule ID survives on the rule itself, for audit records and
     // diagnostics — a different job from being the reference mechanism.
+    //
+    // A policy selects what it governs in ONE of three ways. A rule (`targetRule`),
+    // as above; every rule that enforces a clause of a standard
+    // (`targetStandard`, written `ref :>> targetStandard = <standard>;`); or every
+    // rule whose subject kind sits in a layer (`targetCategory`, a layer
+    // namespace by name, `"memo_assurance_safety_risk"`: a value cannot
+    // reference a package, so this one stays a string). A selection of several rules is
+    // still one decision with one rationale and one approval, so the tailoring
+    // record reports it once, with the rules it reached; a rule added later that
+    // the selection matches is covered by it. An invariant in the selection keeps
+    // running, as it does for a policy naming it.
     part def RulePolicy :> MemoPart {
-        ref targetRule : MemoConsistencyRule;
+        ref targetRule : MemoConsistencyRule[0..1];
+        ref targetStandard : RegulatoryStandard[0..1];
+        attribute targetCategory : String[0..1];
         // A replacement must be another native constraint. A methodology
         // cannot replace a predicate with a string expression stored here.
         ref replacementRule : MemoConsistencyRule[0..1];
@@ -39,25 +54,56 @@ package memo_methodology_core {
     part def MethodologyDefinition :> MemoPart {
         attribute version : String;
         attribute domain : String;
-        attribute :>> description : String;
         // Exactly one base methodology at most. Multiple inheritance is not a
         // multiplicity the resolver has conflict semantics for, so the model
         // does not permit expressing it.
         ref baseMethodology : MethodologyDefinition[0..1];
-        // Whether the inclusion lists below are the whole story. Under
-        // `explicit`, an empty list selects nothing.
+        // Whether the selection below is the whole story. Under `explicit`,
+        // what is not selected is out of scope; under `allAvailable`, every
+        // package the project resolved is in scope and the methodology selects
+        // nothing itself.
         attribute scopeMode : ScopeModeKind;
-        // A methodology is an inclusion set. Layer entries normally name a
-        // public MEMO layer namespace; module entries may name any qualified
-        // package available to the project, including packages outside MEMO.
-        attribute includedLayer : String[0..*];
-        attribute includedModule : String[0..*];
-        attribute includedStandard : String[0..*];
-        attribute includedArtifactKind : String[0..*];
-        attribute includedViewpoint : String[0..*];
+        // The packages a methodology selects are not listed here. They are
+        // what the package declaring the methodology PUBLICLY imports:
+        //
+        //     public import memo_architecture_logical::*;   // a layer
+        //     public import memo_assurance_safety_risk::*;  // one package
+        //     public import memo_extension_ros::*;          // an extension
+        //
+        // A public import is how SysML says a package passes another's members
+        // on to whoever imports it, so the selection is the import, followed
+        // transitively through public imports; a private import is the
+        // package's own business and selects nothing. A layer and an extension
+        // each have one package that publicly imports all of theirs. Because
+        // the package is the selection, a package declares one methodology.
+        // A project adds to the selection the same way, from its entrypoint
+        // package. A misspelled package is an import the compiler rejects.
+        //
+        // The standards, artifact kinds and viewpoints a methodology selects
+        // are TYPED: a standard is a RegulatoryStandard, an artifact kind is an
+        // ArtifactKind literal, a viewpoint is a MemoViewpoint. They were
+        // strings ("ISO 14155", "RiskManagementPlan", "VP-CTX"), and three
+        // standards and an artifact kind in the GPCA methodology named nothing
+        // the ontology declares: a string that matches nothing selects nothing,
+        // and nothing said so. Now the compiler does.
+        ref includedStandard : RegulatoryStandard[0..*];
+        attribute includedArtifactKind : ArtifactKind[0..*];
+        ref includedViewpoint : MemoViewpoint[0..*];
         part rulePolicy : RulePolicy[0..*];
     }
 
+    // Which viewpoints a role works with (plan O12). A viewpoint names the stakeholders it is written for,
+    // and that is what a role sees by default; a methodology may say otherwise for a role, and then THIS is
+    // what the role sees, an override and not an addition. A method that names a base starts from its
+    // role views, and a later one for the same stakeholder replaces the earlier.
+    //
+    //   part rvSafety : RoleView { ref :>> forStakeholder = safetyEngineer; ref :>> shownViewpoint = (vpRiskChain, vpEvidenceTraceability); }
+    part def RoleView :> MemoPart {
+        // `stakeholder` and `viewpoint` are SysML keywords, so neither names a feature.
+        ref forStakeholder : MemoStakeholder;
+        ref shownViewpoint : MemoViewpoint[0..*];
+    }
+
     // Derived, never authored. The resolver projects this from a binding and
     // its methodology chain. If it is serialized for review it is generated
     // output that records its input hashes; it does not compete with the
@@ -65,32 +111,43 @@ package memo_methodology_core {
     // instances of it.
     part def ResolvedMethodology :> MemoPart {
         attribute version : String;
-        // The effective inclusion set after the project binding has added any
-        // project- or supplier-specific modules.
-        attribute includedLayer : String[0..*];
-        attribute includedModule : String[0..*];
     }
 
-    part def ProjectMethodBinding :> MemoPart {
-        attribute projectName : String;
+    // What a model is bound to: its name, the methodology it is governed by,
+    // and the rule policies it adds. "Model" is what Architect opens, one
+    // repository and one compile; "project" means a change set in an iteration.
+    part def ModelMethodBinding :> MemoPart {
+        attribute modelName : String;
         ref selectedMethodology : MethodologyDefinition;
-        // Additive: what the project adds on top of the selected methodology.
-        // An empty list under `explicit` means no project additions.
+        // `allAvailable` widens the model to every package it resolved,
+        // whatever the methodology selects; anything else leaves the
+        // methodology's mode in force. A model ADDS packages to the
+        // selection by importing them publicly in the package that declares
+        // this binding (`public import memo_extension_ros::*;`), the same way
+        // a methodology selects them. There is no list to keep beside it.
         attribute scopeMode : ScopeModeKind;
-        // Project bindings may add project or supplier modules to the selected
-        // methodology without requiring those packages to live under memo::.
-        attribute includedModule : String[0..*];
-        // The submission regimes this project targets, declared once here.
+        // The submission regimes this model targets, declared once here.
         // Everything downstream that needs to know which standards apply —
         // `memo standards check`, the standards checklist, the Architect gap
-        // badges — reads this, so the regime axis is a project fact stated in
+        // badges — reads this, so the regime axis is a model fact stated in
         // SysML rather than a per-document array maintained in 44 places.
-        // Empty means the project has not declared its regimes; a report that
+        // Empty means the model has not declared its regimes; a report that
         // needs them says so rather than assuming a default market.
+        //
+        // DEPRECATED in 0.14.0 (plan O1, O6): a `RegulatedDevice` states its own
+        // jurisdiction, one approval each. This is read only when the model declares
+        // no device, and ignored with a warning when it declares both.
         attribute regulatoryRegime : RegulatoryRegimeKind[0..*];
         part rulePolicy : RulePolicy[0..*];
     }
 
+    // DEPRECATED in 0.14.0, deleted in 0.15.0: the former spelling of
+    // ModelMethodBinding, kept so a model written with it still binds. MEMO
+    // reads `projectName` when `modelName` is absent and warns on either.
+    part def ProjectMethodBinding :> ModelMethodBinding {
+        attribute projectName : String;
+    }
+
     part def DhfDocumentBinding :> MemoPart {
         attribute documentTitle : String;
         attribute groupLabel : String;
@@ -103,7 +160,6 @@ package memo_methodology_core {
 
     part def Archetype :> MemoPart {
         attribute label : String;
-        attribute :>> description : String;
         attribute category : String;
         attribute includedLayer : String;
         attribute includedStandard : String;

package/src/methodology/profiles/memo_profiles.sysml

@@ -6,25 +6,28 @@ package memo_methodology_profiles {
     private import memo_methodology_patterns::*;
     private import memo_methodology_workflow::*;
     private import memo_methodology_gates::*;
+    private import memo_rules_closure::*;
+    private import memo_viewpoints_catalog::*;
+    private import memo_viewpoints_stakeholders_concerns::*;
     private import memo_core_enumerations::*;
     private import memo_core_methodology_scope::*;
 
     private import memo_core_common::*;
     private import memo_core_common::MemoIdentity;
     part mdCoreLibrary : MethodologyLibrary {
-        @MemoIdentity { :>> providedId = "METHLIB-001"; }
-        attribute :>> name = "MedicalDeviceMethodologyLibrary";
-        attribute :>> version = "0.1";
+        @MemoIdentity { :>> providedId = "METHLIB-001"; :>> label = "MedicalDeviceMethodologyLibrary"; }
+        attribute :>> version = "0.15.0";
         attribute :>> domain = "medical device modeling";
-        attribute :>> description = "Methodology layer for selecting, restricting, sequencing, tailoring, and lightly extending use of the medical-device ontology.";
+        doc /* Methodology layer for selecting, restricting, sequencing, tailoring, and lightly extending use of the medical-device ontology. */
     }
 
     // The default methodology deliberately selects everything the project's
     // resolved reusable packages provide. That is what `scopeMode` exists to
     // say: `allAvailable` is an authored decision, not an empty list that the
-    // resolver silently reads as "allow everything". Under `allAvailable` the
-    // inclusion lists must stay empty — authoring both would leave two
-    // competing answers to the same question.
+    // resolver silently reads as "allow everything". Under `allAvailable` this
+    // package imports nothing publicly — a methodology selects by its
+    // package's public imports, and stating both would leave two competing
+    // answers to the same question.
     //
     // Before the flip this methodology carried a narrower `includedLayer` /
     // `includedModule` pair that nothing consumed: effective scope came from
@@ -33,100 +36,257 @@ package memo_methodology_profiles {
     // that into `allAvailable` preserves the effective result and removes the
     // second scope authority.
     part mdDefaultDefinition : MethodologyDefinition {
-        @MemoIdentity { :>> providedId = "METH-MD-DEFAULT"; }
-        attribute :>> name = "MedicalDeviceDefault";
-        attribute :>> version = "0.6.5";
+        @MemoIdentity { :>> providedId = "METH-MD-DEFAULT"; :>> label = "MedicalDeviceDefault"; }
+        attribute :>> version = "0.15.0";
         attribute :>> domain = "medical device modeling";
-        attribute :>> description = "MEMO default medical-device methodology. Selects every layer, discipline, standard, artifact kind, and viewpoint the resolved ontology and extension packages provide.";
+        doc /* MEMO default medical-device methodology. Selects every layer, discipline, standard, artifact kind, and viewpoint the resolved ontology and extension packages provide. */
         attribute :>> scopeMode = ScopeModeKind::allAvailable;
     }
 
     part useRiskAndResidualRule : ElementUsageRule {
-        @MemoIdentity { :>> providedId = "RULE-001"; }
-        attribute :>> name = "UseRiskAndResidualRisk";
+        @MemoIdentity { :>> providedId = "RULE-001"; :>> label = "UseRiskAndResidualRisk"; }
         attribute :>> elementTypeName = "Risk,ResidualRisk,RiskMatrix";
         attribute :>> strength = RuleStrengthKind::recommended;
         attribute :>> rationaleText = "Even a light methodology should distinguish pre- and post-mitigation risk and assess against a matrix.";
     }
 
     part requireVerifiedByRule : RelationUsageRule {
-        @MemoIdentity { :>> providedId = "RULE-002"; }
-        attribute :>> name = "VerifiedBysRequired";
-        attribute :>> relationTypeName = "verify";
+        @MemoIdentity { :>> providedId = "RULE-002"; :>> label = "VerifiedBysRequired"; }
+        attribute :>> relationTypeName = "verifiedBy";
         attribute :>> strength = RuleStrengthKind::required;
         attribute :>> rationaleText = "Safety-relevant requirements and controls shall trace to verification.";
     }
 
     part lightRiskPattern : ModelingPattern {
-        @MemoIdentity { :>> providedId = "PAT-001"; }
-        attribute :>> name = "LightRiskBeforeAfterPattern";
+        @MemoIdentity { :>> providedId = "PAT-001"; :>> label = "LightRiskBeforeAfterPattern"; }
         attribute :>> intent = "Model hazard chain, before/after mitigation risk, controls, and residual evaluation in a lightweight way.";
         attribute :>> stage = WorkflowStageKind::risk;
         attribute :>> strength = RuleStrengthKind::recommended;
     }
 
     part lightTracePattern : ModelingPattern {
-        @MemoIdentity { :>> providedId = "PAT-002"; }
-        attribute :>> name = "CoreTracePattern";
+        @MemoIdentity { :>> providedId = "PAT-002"; :>> label = "CoreTracePattern"; }
         attribute :>> intent = "Need or risk to requirement, requirement to architecture, requirement/control to verification.";
         attribute :>> stage = WorkflowStageKind::requirements;
         attribute :>> strength = RuleStrengthKind::required;
     }
 
-    action stepRequirements : MethodologyWorkflowStep {
-        @MemoIdentity { :>> providedId = "STEP-001"; }
-        attribute :>> name = "CaptureRequirements";
-        attribute :>> stage = WorkflowStageKind::requirements;
-        attribute :>> objectiveDescription = "Capture stakeholder needs and derive requirements.";
-        attribute :>> entryCriteria = "Intended use and actors understood.";
-        attribute :>> exitCriteria = "Initial requirement set exists.";
+    // The default method (plan O11): the steps a family works through, at the system of systems
+    // and at each system. `outputKinds` and the rules a step is `#DoneWhen` say when it is done.
+
+    action stepSosContext : MethodologyWorkflowStep {
+        @MemoIdentity { :>> providedId = "STEP-SOS-01"; :>> label = "SosContext"; }
+        attribute :>> stage = WorkflowStageKind::context;
+        attribute :>> level = MethodLevelKind::systemOfSystems;
+        ref :>> role = projectLead;
+        ref :>> guideViewpoint = vpSystemContext;
+        attribute :>> outputKinds = ("SystemOfSystems", "System");
+        attribute :>> objectiveDescription = "State the system of systems and the systems it is made of.";
+        attribute :>> entryCriteria = "The family is chosen.";
+        attribute :>> exitCriteria = "The system of systems and its constituent systems are declared.";
+    }
+
+    action stepSosOperational : MethodologyWorkflowStep {
+        @MemoIdentity { :>> providedId = "STEP-SOS-02"; :>> label = "SosOperationalAnalysis"; }
+        attribute :>> stage = WorkflowStageKind::operational;
+        attribute :>> level = MethodLevelKind::systemOfSystems;
+        ref :>> role = systemArchitect;
+        ref :>> guideViewpoint = vpUseCase;
+        attribute :>> outputKinds = ("UseCase", "OperationalWorkflow");
+        attribute :>> objectiveDescription = "Describe the clinical procedures the systems serve together, and the workflows that realize them.";
+        attribute :>> entryCriteria = "The constituent systems are declared.";
+        attribute :>> exitCriteria = "Each clinical procedure has a workflow.";
     }
 
-    action stepArchitecture : MethodologyWorkflowStep {
-        @MemoIdentity { :>> providedId = "STEP-002"; }
-        attribute :>> name = "DefineArchitecture";
+    action stepSosFunctions : MethodologyWorkflowStep {
+        @MemoIdentity { :>> providedId = "STEP-SOS-03"; :>> label = "SosFunctionsAndChains"; }
+        attribute :>> stage = WorkflowStageKind::functional;
+        attribute :>> level = MethodLevelKind::systemOfSystems;
+        ref :>> role = systemArchitect;
+        ref :>> guideViewpoint = vpFunctionalFlow;
+        attribute :>> outputKinds = ("FunctionalFlow");
+        attribute :>> objectiveDescription = "Follow the functions across the systems in functional chains.";
+        attribute :>> entryCriteria = "Clinical procedures and workflows exist.";
+        attribute :>> exitCriteria = "Each cross-system chain is stated.";
+    }
+
+    action stepSosArchitecture : MethodologyWorkflowStep {
+        @MemoIdentity { :>> providedId = "STEP-SOS-04"; :>> label = "SosArchitecture"; }
         attribute :>> stage = WorkflowStageKind::architecture;
-        attribute :>> objectiveDescription = "Define key software and hardware architecture elements and interfaces.";
-        attribute :>> entryCriteria = "Initial requirements exist.";
-        attribute :>> exitCriteria = "Core architecture and interfaces exist.";
+        attribute :>> level = MethodLevelKind::systemOfSystems;
+        ref :>> role = systemArchitect;
+        ref :>> guideViewpoint = vpSystemDecomposition;
+        attribute :>> outputKinds = ("Interface");
+        attribute :>> objectiveDescription = "Define the interfaces between the systems.";
+        attribute :>> entryCriteria = "Functional chains exist.";
+        attribute :>> exitCriteria = "Each pair of systems that exchange something has an interface.";
     }
 
-    action stepRisk : MethodologyWorkflowStep {
-        @MemoIdentity { :>> providedId = "STEP-003"; }
-        attribute :>> name = "PerformRiskAnalysis";
+    action stepSosHazards : MethodologyWorkflowStep {
+        @MemoIdentity { :>> providedId = "STEP-SOS-05"; :>> label = "SosHazards"; }
         attribute :>> stage = WorkflowStageKind::risk;
-        attribute :>> objectiveDescription = "Create core risk chain and controls.";
-        attribute :>> entryCriteria = "Initial requirements and key behavior exist.";
-        attribute :>> exitCriteria = "Risk and control model exists.";
+        attribute :>> level = MethodLevelKind::systemOfSystems;
+        ref :>> role = safetyEngineer;
+        ref :>> guideViewpoint = vpRiskChain;
+        attribute :>> outputKinds = ("Hazard");
+        attribute :>> objectiveDescription = "Identify the hazards that arise only from the systems working together.";
+        attribute :>> entryCriteria = "The architecture and its interfaces exist.";
+        attribute :>> exitCriteria = "Each hazard of the combination has a control.";
+    }
+    #DoneWhen dependency from stepSosHazards to memo_rules_closure::HazardMitigationRule;
+
+    action stepSysOperational : MethodologyWorkflowStep {
+        @MemoIdentity { :>> providedId = "STEP-SYS-01"; :>> label = "SystemOperational"; }
+        attribute :>> stage = WorkflowStageKind::operational;
+        attribute :>> level = MethodLevelKind::system;
+        ref :>> role = systemArchitect;
+        ref :>> guideViewpoint = vpUseCase;
+        attribute :>> outputKinds = ("UseCase");
+        attribute :>> objectiveDescription = "State what the system is used for.";
+        attribute :>> entryCriteria = "The system is declared.";
+        attribute :>> exitCriteria = "Each use of the system is a use case.";
+    }
+
+    action stepSysFunctional : MethodologyWorkflowStep {
+        @MemoIdentity { :>> providedId = "STEP-SYS-02"; :>> label = "SystemFunctional"; }
+        attribute :>> stage = WorkflowStageKind::functional;
+        attribute :>> level = MethodLevelKind::system;
+        ref :>> role = systemArchitect;
+        ref :>> guideViewpoint = vpFunctionalArchitecture;
+        attribute :>> outputKinds = ("SystemFunction");
+        attribute :>> objectiveDescription = "State what the system does.";
+        attribute :>> entryCriteria = "The system use cases exist.";
+        attribute :>> exitCriteria = "Each function is stated.";
+    }
+
+    action stepSysLogical : MethodologyWorkflowStep {
+        @MemoIdentity { :>> providedId = "STEP-SYS-03"; :>> label = "SystemLogical"; }
+        attribute :>> stage = WorkflowStageKind::logical;
+        attribute :>> level = MethodLevelKind::system;
+        ref :>> role = systemArchitect;
+        ref :>> guideViewpoint = vpLogicalArchitecture;
+        attribute :>> outputKinds = ("LogicalComponent");
+        attribute :>> objectiveDescription = "Divide the system into logical components and allocate its functions.";
+        attribute :>> entryCriteria = "The system functions exist.";
+        attribute :>> exitCriteria = "Every function is allocated to a component.";
+    }
+    #DoneWhen dependency from stepSysLogical to memo_rules_closure::LogicalFunctionAllocationRule;
+
+    action stepSysHardware : MethodologyWorkflowStep {
+        @MemoIdentity { :>> providedId = "STEP-SYS-04"; :>> label = "SystemHardware"; }
+        attribute :>> stage = WorkflowStageKind::physical;
+        attribute :>> level = MethodLevelKind::system;
+        ref :>> role = hardwareEngineer;
+        ref :>> guideViewpoint = vpHardwareArchitecture;
+        attribute :>> outputKinds = ("PhysicalAssembly");
+        attribute :>> objectiveDescription = "Realize the logical components in hardware.";
+        attribute :>> entryCriteria = "The logical components exist.";
+        attribute :>> exitCriteria = "The hardware assemblies are declared.";
     }
 
-    action stepVerification : MethodologyWorkflowStep {
-        @MemoIdentity { :>> providedId = "STEP-004"; }
-        attribute :>> name = "PlanVerification";
+    action stepSysSoftware : MethodologyWorkflowStep {
+        @MemoIdentity { :>> providedId = "STEP-SYS-05"; :>> label = "SystemSoftware"; }
+        attribute :>> stage = WorkflowStageKind::physical;
+        attribute :>> level = MethodLevelKind::system;
+        ref :>> role = softwareArchitect;
+        ref :>> guideViewpoint = vpSoftwareComponents;
+        attribute :>> outputKinds = ("SoftwareSystem");
+        attribute :>> objectiveDescription = "Realize the logical components in software.";
+        attribute :>> entryCriteria = "The logical components exist.";
+        attribute :>> exitCriteria = "The software is declared.";
+    }
+
+    action stepSysHumanFactors : MethodologyWorkflowStep {
+        @MemoIdentity { :>> providedId = "STEP-SYS-06"; :>> label = "SystemHumanFactors"; }
+        attribute :>> stage = WorkflowStageKind::humanFactors;
+        attribute :>> level = MethodLevelKind::system;
+        ref :>> role = usabilityEngineer;
+        ref :>> guideViewpoint = vpHumanFactors;
+        attribute :>> outputKinds = ("UserInterface");
+        attribute :>> objectiveDescription = "Design how people use the system.";
+        attribute :>> entryCriteria = "The system use cases exist.";
+        attribute :>> exitCriteria = "The user interface is declared.";
+    }
+
+    action stepSysRisk : MethodologyWorkflowStep {
+        @MemoIdentity { :>> providedId = "STEP-SYS-07"; :>> label = "SystemRisk"; }
+        attribute :>> stage = WorkflowStageKind::risk;
+        attribute :>> level = MethodLevelKind::system;
+        ref :>> role = safetyEngineer;
+        ref :>> guideViewpoint = vpRiskChain;
+        attribute :>> outputKinds = ("Hazard", "Risk");
+        attribute :>> objectiveDescription = "Identify hazards, estimate risk and state the controls.";
+        attribute :>> entryCriteria = "The system functions exist.";
+        attribute :>> exitCriteria = "Each hazard has a control.";
+    }
+    #DoneWhen dependency from stepSysRisk to memo_rules_closure::HazardMitigationRule;
+
+    action stepSysSecurity : MethodologyWorkflowStep {
+        @MemoIdentity { :>> providedId = "STEP-SYS-08"; :>> label = "SystemSecurity"; }
+        attribute :>> stage = WorkflowStageKind::security;
+        attribute :>> level = MethodLevelKind::system;
+        ref :>> role = securityEngineer;
+        ref :>> guideViewpoint = vpCybersecurity;
+        attribute :>> outputKinds = ("Threat");
+        attribute :>> objectiveDescription = "Identify threats and state the mitigations.";
+        attribute :>> entryCriteria = "The system functions exist.";
+        attribute :>> exitCriteria = "Each threat is mitigated.";
+    }
+    #DoneWhen dependency from stepSysSecurity to memo_rules_closure::ThreatMitigationRule;
+
+    action stepSysVerification : MethodologyWorkflowStep {
+        @MemoIdentity { :>> providedId = "STEP-SYS-09"; :>> label = "SystemVerification"; }
         attribute :>> stage = WorkflowStageKind::verificationStage;
-        attribute :>> objectiveDescription = "Define verification and evidence expectations.";
-        attribute :>> entryCriteria = "Requirements and controls exist.";
-        attribute :>> exitCriteria = "Verification cases and evidence targets exist.";
+        attribute :>> level = MethodLevelKind::system;
+        ref :>> role = verificationEngineer;
+        ref :>> guideViewpoint = vpVerificationCoverage;
+        attribute :>> outputKinds = ("VerificationCase");
+        attribute :>> objectiveDescription = "Verify what the system must do and the controls it relies on.";
+        attribute :>> entryCriteria = "Risks and their controls exist.";
+        attribute :>> exitCriteria = "Each verification case has a target.";
+    }
+    #DoneWhen dependency from stepSysVerification to memo_rules_closure::VerificationCaseTargetRule;
+
+    action stepSysRelease : MethodologyWorkflowStep {
+        @MemoIdentity { :>> providedId = "STEP-SYS-10"; :>> label = "SystemRelease"; }
+        attribute :>> stage = WorkflowStageKind::release;
+        attribute :>> level = MethodLevelKind::system;
+        ref :>> role = regulatoryEngineer;
+        attribute :>> outputKinds = ("ReleaseRecord");
+        attribute :>> objectiveDescription = "Release the system: its part number, revision and the commit it was built from.";
+        attribute :>> entryCriteria = "The system is verified.";
+        attribute :>> exitCriteria = "The release has a record.";
     }
-    first stepRequirements then stepArchitecture;
-    first stepArchitecture then stepRisk;
-    first stepRisk then stepVerification;
+
+    // Order, within a level.
+    first stepSosContext then stepSosOperational;
+    first stepSosOperational then stepSosFunctions;
+    first stepSosFunctions then stepSosArchitecture;
+    first stepSosArchitecture then stepSosHazards;
+
+    first stepSysOperational then stepSysFunctional;
+    first stepSysFunctional then stepSysLogical;
+    first stepSysLogical then stepSysHardware;
+    first stepSysLogical then stepSysSoftware;
+    first stepSysOperational then stepSysHumanFactors;
+    first stepSysFunctional then stepSysRisk;
+    first stepSysFunctional then stepSysSecurity;
+    first stepSysRisk then stepSysVerification;
+    first stepSysVerification then stepSysRelease;
 
     part gateLightComplete : QualityGate {
-        @MemoIdentity { :>> providedId = "GATE-001"; }
-        attribute :>> name = "LightMethodReady";
+        @MemoIdentity { :>> providedId = "GATE-001"; :>> label = "LightMethodReady"; }
         attribute :>> gateStage = WorkflowStageKind::verificationStage;
         attribute :>> passCriteria = "Core traceability, risk, verification, and RMF view support are present.";
     }
 
     // The GPCA binding used to live here, in the reusable default methodology,
     // naming its methodology by string. A project binding is project content:
-    // it now lives in the GPCA project's own `model/catalog/project.sysml` and
+    // it now lives in the GPCA project's own `model/methodology/project.sysml` and
     // references its methodology with a typed SysML reference.
 
     part rmpDoc : DhfDocumentBinding {
-        @MemoIdentity { :>> providedId = "DHF-001"; }
-        attribute :>> name = "RiskManagementPlan";
+        @MemoIdentity { :>> providedId = "DHF-001"; :>> label = "RiskManagementPlan"; }
         attribute :>> documentTitle = "Risk Management Plan";
         attribute :>> groupLabel = "Risk Management";
         attribute :>> templateId = "iso-14971/rmp";
@@ -137,8 +297,7 @@ package memo_methodology_profiles {
     }
 
     part harDoc : DhfDocumentBinding {
-        @MemoIdentity { :>> providedId = "DHF-002"; }
-        attribute :>> name = "HazardAnalysisReport";
+        @MemoIdentity { :>> providedId = "DHF-002"; :>> label = "HazardAnalysisReport"; }
         attribute :>> documentTitle = "Hazard Analysis Report";
         attribute :>> groupLabel = "Risk Management";
         attribute :>> templateId = "iso-14971/har";
@@ -149,8 +308,7 @@ package memo_methodology_profiles {
     }
 
     part sadDoc : DhfDocumentBinding {
-        @MemoIdentity { :>> providedId = "DHF-003"; }
-        attribute :>> name = "SoftwareArchitectureDescription";
+        @MemoIdentity { :>> providedId = "DHF-003"; :>> label = "SoftwareArchitectureDescription"; }
         attribute :>> documentTitle = "Software Architecture Description";
         attribute :>> groupLabel = "Software";
         attribute :>> templateId = "iec-62304/sad";
@@ -161,8 +319,7 @@ package memo_methodology_profiles {
     }
 
     part threatModelDoc : DhfDocumentBinding {
-        @MemoIdentity { :>> providedId = "DHF-004"; }
-        attribute :>> name = "CybersecurityThreatModel";
+        @MemoIdentity { :>> providedId = "DHF-004"; :>> label = "CybersecurityThreatModel"; }
         attribute :>> documentTitle = "Threat Model";
         attribute :>> groupLabel = "Cybersecurity";
         attribute :>> templateId = "fda-cybersecurity/threat-model";
@@ -173,8 +330,7 @@ package memo_methodology_profiles {
     }
 
     part vvPlanDoc : DhfDocumentBinding {
-        @MemoIdentity { :>> providedId = "DHF-005"; }
-        attribute :>> name = "VerificationValidationPlan";
+        @MemoIdentity { :>> providedId = "DHF-005"; :>> label = "VerificationValidationPlan"; }
         attribute :>> documentTitle = "V&V Plan";
         attribute :>> groupLabel = "Verification & Validation";
         attribute :>> templateId = "21cfr820/vv-plan";

package/src/methodology/workflow/memo_workflow.sysml

@@ -3,6 +3,9 @@ package memo_methodology_workflow {
 
     private import memo_core_common::*;
     private import memo_core_enumerations::*;
+    private import memo_core_relationships::*;   // MemoTypedDependency
+    private import memo_viewpoints_stakeholders_concerns::MemoStakeholder;
+    private import memo_viewpoints_definitions::MemoViewpoint;
 
     // Named for its axis: this is a step in a METHODOLOGY workflow (a lifecycle
     // stage with entry/exit criteria), distinct from an OPERATIONAL workflow's
@@ -10,10 +13,35 @@ package memo_methodology_workflow {
     // two carry different attributes and must not share a short name — an
     // overloaded name resolves by load order and silently validates a usage
     // against the wrong type.
+    //
+    // A methodology's steps are the usages of this type in the package that
+    // declares it; a methodology that names a `baseMethodology` adds its steps to
+    // that one's, base first (a step is added, never replaced or dropped).
+    // Order is `first <step> then <step>;`, within a level.
+    //
+    // What makes a step DONE is stated, not assumed (plan O11, T10): every
+    // `outputKinds` kind has an element in the workspace, and every rule the step
+    // `#DoneWhen`s has a subject there and no finding on it. A step that states
+    // neither has no done criterion and is never reported as done.
     action def MethodologyWorkflowStep :> MemoAction {
         attribute stage : WorkflowStageKind;
         attribute objectiveDescription : String;
         attribute entryCriteria : String;
         attribute exitCriteria : String;
+        // Where the step is worked: on the system of systems, or on one system.
+        attribute level : MethodLevelKind[0..1];
+        // Who does it. A usage name from the stakeholders the viewpoints bind.
+        ref role : MemoStakeholder[0..1];
+        // Kind names, as `visibleKinds` of a viewpoint are: a value cannot reference a
+        // definition. A kind the ontology does not declare is a finding of the selector
+        // vocabulary check, not a silent step that can never be done.
+        attribute inputKinds : String[0..*];
+        attribute outputKinds : String[0..*];
+        // The viewpoint that opens this step in the Guide. (`viewpoint` is a SysML keyword.)
+        ref guideViewpoint : MemoViewpoint[0..1];
+    }
+
+    metadata def DoneWhen :> MemoTypedDependency {
+        doc /* `#DoneWhen dependency from <step> to <rule>, <rule>;` The step is done when each of these rules has a subject in the workspace and no finding on it. */
     }
 }